1. Field of the Invention
The present invention relates to a method and apparatus for protecting a computer system against vandalism commonly known as computer viruses.
2. Description of the Related Art
As the world becomes more and more computerized, one of the great concerns of the data processing industry has been possible attacks on a computer system by viruses. In less serious cases, an attack by a computer virus may force an organization to replicate or recover data and files before it can resume normal operation. In more serious cases, data and files destroyed by a virus may become unrecoverable, forever shutting down the organization's operation. In the most serious cases, the integrity of an organization's data bases may have been attacked without warning, and the organization continues operation using inaccurate data, resulting in injuries, losses and damages.
The virus problem is aggravated because typical computer viruses are, like biological viruses, capable of self-replication, and computers can be infected through connection to networks. Viruses can also attach themselves to application and/or system programs. Moreover, a relatively harmless virus may undergo "mutation" (modified during its residence in a computer system) to become a fatal one.
One common way which viruses attack a computer system is by changing the interrupt vectors in the system so that the virus can affect the operation of the system and the I/O devices. Therefore, one prior art anti-virus method sets hooks on interrupt vectors and interrupt program instructions in order to detect attempts by a virus to change the interrupt vectors.
In another prior art anti-virus method, programs to be executed in the system first undergo a self-test to detect whether the program has been modified. If a program has been modified, it may have been infected and execution of the program in the system is inhibited.
In yet another prior art anti-virus method, predefined characteristics (e.g., a check sum) of each program in its uninfected state are stored. Before a program is executed, these characteristics are regenerated and compared with their corresponding stored counterparts to determine whether it has been modified.
However, these prior art methods are unsatisfactory for three reasons. First, the operation of these prior art method requires assistance of the computer's operating system (e.g., DOS). Since the operating system can only function after successfully booting the computer system, these prior art methods cannot protect the computer from viruses that attack when a computer system boots, i.e., before installation of the operating system. Second, the prior art is unable to prevent viruses which bypass the operating system and operate directly on the hardware or the BIOS. Third, existing anti-virus systems cannot prevent viruses which reside in the operating system modules (e.g., IO.SYS, MSDOS.SYS, and COMMAND.COM).
Therefore, there is a need for a method and apparatus for protecting computer systems against viruses, not only by preventing viruses from entering into a computer system, but also by removing and disabling a virus that already resides in the computer system. Also, there is a need for protection from viruses during the period when the systems boots up.